CVE-2026-16554 Integer Overflow Leading to Heap Buffer Overflow in cJSON

Medium 5.1 Published 27 Jul 2026 Updated 31 Jul 2026

Integer overflow in cJSON on 32-bit platforms allows heap buffer overflow via crafted JSON, potentially leading to remote code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-16554?

CVE-2026-16554 is a medium-severity vulnerability in DaveGamble cJSON, published on 27 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.

Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

Weakness: CWE-190

Which versions are affected by CVE-2026-16554?

It affects 1 product.

Products include Davegamble Cjson.

How do I fix CVE-2026-16554?

No fix published yet.

Is CVE-2026-16554 being exploited?

There is no known exploitation of CVE-2026-16554 in the wild and no public exploit code.

Sources

Also known as AZL-94184, AZL-94244, DEBIAN-CVE-2026-16554, GHSA-qv6q-8g2j-w47g, ROOT-OS-ALPINE-321-CVE-2026-16554, ROOT-OS-ALPINE-323-CVE-2026-16554 and 1 more.